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Disclosure to Promote the Right To Information 

Whereas the Parliament of India has set out to provide a practical regime of right to 
information for citizens to secure access to information under the control of public authorities, 
in order to promote transparency and accountability in the working of every public authority, 
and whereas the attached publication of the Bureau of Indian Standards is of particular interest 
to the public, particularly disadvantaged communities and those engaged in the pursuit of 
education and knowledge, the attached public safety standard is made available to promote the 
timely dissemination of this information in an accurate manner to the public. 
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FOREWORD 

This Indian Standard (First Revision) was adopted by the Bureau of Indian Standards, after the draft finalized by 
Occupational Safety and Health and Chemical Hazards Sectional Committee had been approved by the Chemical 
Division Council 

Health and safety is one of the most important aspects of an organization's smooth and effective functioning. 
Good health and safety performance ensures an accident free industrial environment. With the continuous and 
untiring effort of various legislative authorities as well as NGOs, the awareness of occupational health and safety 
(OH&S) has improved in India considerably. Organizations have started attaching the same importance to achieve 
high OH&S performance as they do to other key aspects of their business activities. Considering this fact and a 
great demand from the industry for a comprehensive framework for OH&S, the Committee formulated IS 18001 
in the year 2000 taking considerable assistance from BS 8800 : 1996 'Guide to occupational health and safety 
management system' ; and AS/NZS 4804 : 1 997 *Occupational health and safety management systems — General 
guidance and principles, assessment and supporting techniques'. 

There is no ISO Standard on the subject. Based on the experiences gained since last 5 years, and the revision of 
ISO 14001 : 1996 'Environmental management systems — Requirement guidance for use* as well as both the 
base standards, the Committee felt to revise the standard to make it more compatible^with latest ISO 14001 
keeping in mind the interest of the users for integrating with other management system. 

This standard intends to assist the organizations to develop a systematic approach to management of OH&S in 
such a way as to protect their employees and others whose health and safety may be affected by the organizations' 
activities. This standard also intends to improve OH&S performance of organizations by providing the requirements 
and guidance for use. The OH&S management systems may be integrated with the management of other aspects 
of business performance in order to: 

a) minimize risk to employees and others, 

b) improve business performance, and 

c) assist organizations to establish a responsible image at the marketplace. 

The requirements of OH&S management systems have been prescribed in this standard. Annex A provides the 
guidance for use and correct interpretation. Annex B gives a comparison of requirements of this standard with 
those of IS/ISO 9001 : 2000 and IS/ISO 14001 : 2004. It is expected that this comparative chart will help the 
users in understanding the standard in a better way. Identification of hazard and assessment and control of risks 
form a major and important part of OH&S management systems. A general guideline describing the principles, 
approach and procedure of hazard identification and assessment and control of risks has been given in Annex C 
though the Committee also developed a separate Indian Standard IS 15656 : 2006 'Hazard identification and risk 
analysis — Code of practice*, 

CompHance with this standard by an organization does not confer its immunity from its legal obligations. 

The composition of the Committee responsible for formulation of this standard is given at Annex D; 
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1 SCOPE 

This standard prescribes requirements for an 
occupational health and safety (OH&S) management 
system, to enable an organization to formulate a policy 
and objectives, taking into account legislative 
requirements and information about significant hazards 
and rivsk:s, which the organization can control and over 
which it can be expected to have an intluence, to protect 
its employees and others, whose health and safety may 
be affected by the activities of the organization. It does 
not itself state specific safety performance criteria. This 
standard is applicable to any organization that wishes 
to: 

a) Implement, maintain and continually improve 
an OH&S management system; 

b) Assure itself of its conformance with its stated 
OH&S policy; 

c) Demonstrate such conformance to others; 

d) Seek certification/registration of its OH&S 
mi^nagement systems by an external 
organization; and 

c) Make a self-determination and self- 
declaration of conformance with this standard. 

All the requirements in this standard are intended to 
be incorporated into any OH&S management system. 
The extent of application will depend on such factors 
as the OH&S policy of the organization, the nature of 
its activities and the conditions in which it operates. 
This Indian Standard also provides informative 
guidance on the use of the requirements in Annex A. 

NOTES 

1 For ease of use, the sub-clause*^ of this spccificiuion and Annex 
A have related numbers; thus, for example, 4.3.J and A-3.3 both 
deal with 'Legal and other requirements'. 

2 The guidance has been provided to ensure that managers 
who have already invested in learning to operate within the 
Irainework of either Quality Management Syj-tems or 
Environ mental Management Systems standards can readily 
understand the requirements of this standard and thereby 
improve OH&S management in their organization. 

2 REFERENCES 

The standards listed below contain provisions, which 



through reference in this text, constitute provisions of 
this standard. At the time of publication, the editions 
indicated were valid. All standards are subject to 
revision, and parties to agreements based on this 
standard are encouraged to investigate the possibility 
of applying the most recent editions of the standards 
indicated below: 



fS No, 

3786 : 1983 



Title 



Method of computation of frequency 
and severity rates for industrial injuries 
and classification of industrial 
accidents {first revision) 

IS/ISO 14001 : Environmental management systems 
2004 — Requirements with guidance for 

use 

IS 14489 : 1998 Code of practice on occupational 
safety and health audit 

3 TERMINOLOGY 

For the purpose of this standard, die definitions given in 
IS/ISO 14001, IS 14489 and tlie following shall apply. 

3*1 Accident — Unplanned/Undesired event giving rise 
to death, ill health, injury, damage or other losses to 
personnel or property. 

3.2 Audit — A systematic, independent and a documented 
process for obtaining evidence and evaluating it 
objectively to determine the extent to which defined 
criteria are fulfilled. 

NOTE — The word 'independent' here does not necessarily 
mean external to the organization. 

3.3 Continual Improvement — Recurring process of 
enhancing the OH&S management system, to achieve 
improvements in overall OHS performance 

3*4 Hazard — A source or a situation with a potential 
to cause harm in terms of human injury or ill health, 
damage to property, damage to the environment or a 
combination of these. 

3.5 Hazard Identification — The process of recognizing 
a hazard in existence and defining its characteristic/ 
impact. 

3.6 Incident^^^ Event that give rise to an accident or 
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has I he potential to lead to an accident. 

NOTt: — An incident where no ;li health, injury, ckunyge tir 
other loss occurs is also referred to as *near-miss , The tertn 
incident' includes 'near-misses'. 

3:7 Interested Party — Individual or group concerned 
with or affected by the OH&S performance of an 
organization. 

3.8 Non-conformity — Non-fulfilment of a requirement 
[IS/ISO 9000 : 2000, 3,6.2] 

3.9 Occupational 111 Health — 111 health that is judged 
to have been caused by or made worse by a person's 
work activity or environment. 

3.10 Occupational Health and Safety Management 
System — A set of interrelated or interacting elements 
to establish OH&S Policy and objectives, and to 
achieve those objectives. 

3.11 Occupational Health and Safety 

Objectives — Overall goals in terms of OH&S 
pertormance, arising from the OH&S policy that an 
organization sets itself to achieve, and which is 
quantified where practicable. 

3.12 Occupational Health and Safety Policy — 

Overall intentions and direction of an organization in 
relation to its overall OH&S performance as fortrially 
expressed by top management. 

NOTE — The OH&.S Policy provides a framework tor its action 
and for setting its OH&S objectives and targets. 

3.13 Occupational Health and Safety Professional — 

A person, with expertise and qualifications in the 
assessment, evaluation and prevention or control of 
occupational risks, hazards or occupational ill health. 

3.14 Occupational Health and Safety Target — A 

detailed performance requirement quantified wherever 
practicable pertaining to the organization, that arises 
from the health and safety objectives and that needs to 
be met in order to achieve those objectives. 

3.15 Occupational Health Surveillance — 

Monitoring the health of people to detect signs or 
sytnptoms of work related ill health so that steps can 
be taken to eliminate, or reduce the probability of 
fu Fiber deterioration. 

3.16 Rehabilitation — The managed process of 
maintaining injured or ill employees in, or returning 
ihem to suitable employment. 

3.17 Risk — The combination of frequency, or 
probability of occurrence and consequence of a 
specified hazardous event. 

3.18 Risk Analysis — A systematic use of available 
information lo determine how often specified events 
may occur and magnitude of their likely consequences. 



3.19 Risk Assessment — The overall process of 
estimating the magnitude of risk and deciding whether 
the risk is tolerable. 

3.20 Safety — State in which the risk of harm to 
persons or damage to property is limited to a tolerable 
level. 

3.21 Tolerable Risk — Risk that has been reduced to 
a level that can be endured by the organization having 
regards to its legal obligations and its own OH&S 

Policy. 

4 OH&S MANAGEMENT SYSTEMS 
REQUIREMENTS 

4.1 General Requirements 

The organization shall establish, document, implement, 
maintain and continually improve an OH&S 
management system, in accordance with the 
requirements of this standard. The organization shall 
define and document the scope of its OH&S 
management system. 

4-2 OH&S Policy 

Top management shall define, document and endorse 
its OH&S policy. The policy shall: 

a) be appropriate to the nature, scale and the 
hazards and risks of its activities and facilities; 

b) includes a commitment to continual 
improvement in its OH&S performance; 

c) include a commitment to comply with the 
applicable OH&S legislations and with other 
requirements to which the organizations 
subscribe; 

d) be implemented, maintained, communicated 
to all employees and understood within the 
organization; 

e) provide a framework for establishing, 
maintaining and periodically reviewing 
OH&S objectives and targets; 

f) be reviewed periodically to ensure that it 
remains relevant and appropriate to the 
organization; and 

g) be available to the public. 

4.3 Planning 

43A Initial OH&S Review 

The organization shall carry out an initial review of 
their existing arrangements for managing OH&S. The 
current position of an organization with regard to 
OH&S shall be established by means of an initial 
review of its current OH&S arrangements to: 

a) Identify the gaps between any existing 
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systems in place and the requirements of this 
standard; 

b) Identify all hazards and risks associated with 
the organization's activity and facilities; 

c) Assess the level of knowledge and compliance 
with all OH&S standards and legislation; 

d) Compare current arrangements with best 
practice and performance in the organization's 
employment sector and other appropriate 
sectors; 

e) Review past experience with incidents and 
results of any previous assessments, 
compensation experience, disruption, etc, 
associated with OH&S; and 

Assess efficiency and effectiveness of existing 
resources devoted to OH&S management. 

The organization shall document this information and 

shall plan. the progressive implementation of the 
elements of the system based on this information. 

4.3.2 Hazard Identification Risk Assessment and Risk 
Control 

The organization shall establish, implement and 
maintain procedures for the ongoing identification of 
hazards^ assessment of associated risks and necessary 
control measures related to its activities and facilities 
over which it has control or influence, in order to 
determine those which have or can have significant 
impact over OH&S. This shall include: 

a) Routine and non-routine activities; 

b) Activities of all personnel having access to 
the workplace (including sub-coniractors and 
visitors); and 

c) Facilities at the work place, whether provided 
by the organizations or others. 

The organization shall ensure that the results of these 
assessments and the effects of these controls are 
considered while setting its OH&S objectives. The 
organization shall document this information and keep 
it uptodate. 

4.33 Legal and Other Requirements 

l"he organization shall establish, implement and 
maintain a procedure(s): 

a) to identify and have access to all legal and 
other requirements to which the organization 
subscribes and that are attributable to the 
OH&S hazards and risks of its activities and 
facilities. 

b) to determine how these requirements apply 
to its OH&S hazards and risks. 

The organization shall also keep track of legal and other 



requirements as well as the changes to these to maintain 
regulatory compliance. It shall ensure communication 
of relevant information on legal and other requirements 
to its employees at all times. 

4.3.4 Objectives, Targets, Performance Indicators and 
Programme(s) 

The organization shall establish, implement and 
maintain documented OH&S objectives and targets at 
relevant functions and levels within the organization. 

When establishing and reviewing its objectives, an 
organization shall consider the legal and other 
requirements, its significant hazards and risks, its 
technological options and its financial, operational and 
business requirements and views of the interested 
parties. The objectives and targets shall be measurable 
where practicable and consistent with the OH&S 
policy, including the commitment to health and safety 
at workplace, to compliance with applicable legal 
requirements and to continual improvement. 

Objectives, targets and programme(s) shall be regularly 
reviewed at planned intervals and revised, if necessary. 
The organization shall establish, implement and 
maintain programme(s) for achieving its objectives and 
targets. It shall include: 

a) Designation of responsibility for achievement 
of objectives and targets at relevant functions 
and levels of the organization, and 

b) Means and timeframe by which they are to 
be achieved. 

If a project relates to new developments and new or 
modified activities and services, programme(s) shall 
be amended appropriately, where relevant, to ensure 
that OH&S management applies to such projects. 

When the objectives and targets are set, the organization 
shall consider establishing measurable OH&S 
performance indicators. These indicators shall be used 
as a basis for an OH&S performance evaluation system 
and to provide information on both OH&S 
management and operation systems. 

4.4 Implementation and Operation 

4.4.1 Resources, Roles, Responsibility and Authority 

Roles, responsibilities and authorities of the personnel 
who manage, perform and verify activities having an 
effect on the OH&S risks of the organization's 
activities, facilities, processes and services, shall be 
defined, documented and communicated to facilitate 
effective OH&S management. OH&S responsibilities, 
accountabilities and authorities to act and reporting 
relationships or ail levels of functionaries including 
sub-contractors and visitors shall be defined, 
documented and communicated. 
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Ultimate rcsp^onsibility for OH&S shall rest with the 
top managemeni. The organization shall dctine, 
designate, document and communicate OH&S 
responsibilities and authority to act and reporting 
relationships for all levels of functionaries including 
sub-contractors and visitors. The organization shall also 
establish and maintain procedure that monitors and 
communicate any changes in designated 
responsibilities and authorities and the organization 
shall be able to respond in a timely and effective manner 
to changing or unusual circumstances or events. 

The organization's top management shall appoint at 
the senior management level specific management 
representative(s), with executive powers, who, 
irrespective of other responsibilities, shall have defined 
roies, responsibilities and authority for: 

a) Ensuring that OH&S management system 
requirements are established, implemented 
and maintained in accordance with this Indian 
Standard; and 

b) Reporting on the performance of OH&S 
management system to top management for 
review and iiN a basis for improvement of the 
OH&S management system. 

Management shall provide adequate resources essential 
to establish, implement, maintain/control and 
improvement of the OH&S management system. 
Resources include human resources including 
specialized skills, organizational infrastructure, 
technology and fmancial resources. 

4.4.2 Competenci', Training and Awareness 

The organization shall ensure that any person(s) 
performing tasks for it or on its behalf whose work/ 
workplace involves significant hazard, identified by 
the organization is(are} competent on the basis of 
appropriate education, training or experience, and shall 
retain associated records. The organization shall also 
establish, implement and maintain a procedure(s) to 
identify the competency standards and to meet them. 

fhe organization shall identify training needs for all 
personnel whose work/ workplace involves significant 
hazard associated with its OH&S management system. 
It shall provide training or take other action to meet 
these tieeds, evaluate its effectiveness, and shall retain 
associated records. 

It shall establish and maintain procedures to make its 
employees or members at each relevant function and 
level aware of: 

a) The importance of conformance with the 
OH&S policy and procedures and with 
requirements of the OH&S management 
system; 



b) The significant hazards and risks actual or 
potential, of their work activities and the 
benefits of improved OH&S performance; 

c) Their roles and responsibilities in achieving 
conformance with OH&S policy and 
procedures and with the requirements of 
OH&S management systems; and 

d) The potential consequences of departure from 
specified operating procedures. 

4.4.3 Communication and Reporting 

4.4.3.1 Communication 

Organization shall establii^h, impleinent and maintain 
procedure(s) to ensure that pertinent OH&S 
Information including significant risks and hazards are 
communicated and from employees and other 
interested parties. The organization shall ensure: 

a) Communicating the results from management 
systems monitoring, audit and management 
reviews to those within the organization who 
are responsible for and have a stake in the 
organization's performance; 

b) Receiving, documenting and responding to 
relevant communication on OH&S from 
external interested panics; and 

c) Communicating the relevant information to 
people outside organization who are likely to 
be affected. 

4*4,3.2 Reporting 

The organization shall establish, implement and 
maintain documented procedures for relevant and 
timely reporting of information required for monitoring 
and continual improvement of OH&S performance. 
Internal reporting procedures shall cover; 

a) Incident occurring reporting, 

b) Non-conformance reporting, 

c) Health and safety performance reporting, and 

d) Hazard identification reporting. 

External reporting procedures shall cover: 

a) Statutory reporting requirements, and 

b) Stakeholder reporting. 

4.4.4 Documentation 

The OH&S Management System documentation shall 
include: 

a) OH&S Policy, objectives and targets; 

b) Description of the scope of the OH&S 
management system; 

c) Description of the main elements of the 
OH&S management systems and their 
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interaction, and reference to related 
documentation; 

d) Documents, including records, required by 
this Indian Standard; and 

e) Documents, including records, determined by 
the organization to ensure the effective 
implementation of OH&S management 
system. 

NOTE — II is important that documented procc'.iurcs and work 
instructions are treated with productivity in mind and with 
health & safety matter integrated into each step and the design 
and review of such procedures are developed hy competent 
people together with involvement from tliose required to 
perform the lask(s). Such documented procedures and woric 
instructions are commonly known as systems of work or 
standard operation procedure. 

4.4.5 Control of Documents 

The organization shall establish, implement and 
maintain a procedure(s) for controlling all documents 
required by the OH&S management syslen-s and by 
thts standard: 

a) Documents are approved for adequacy prior 
to issues; 

b) Documents are periodically reviewed, revised 
as and when necessary and re-approved for 
adequacy by authorized personnel; 

c) Changes and the current revision status of 
documents are identified; 

d) The current versions of relevant documents 
are available at all locations; 

e) Obsolete documents are promptly removed 
from all points of issue and points of use, or 
otherwise assured against unintended use; 

f) Any obsolete documents retained for legal 
and/or knowledge preservation purposes are 
suitably identified; 

g) Documents remain legible, dated (with dates 
of revision) and readily identified; and 

h) Documents of external origin determined by 
the organization to be necessary for the 
planning and operation of the OH&S 
management systems are identified and their 
distribution controlled. 

Records arc special type of documents and shall be 
ct.mtrolled in accordance with the requirement given 
in 4.5.4. 

4.4.6 Operational Control 

The organization shall identify those operations and 
activities that are associated with the identified 
signitlcant hazards and risks in line with its policy, 
objectives and targets. The organization shall plan these 
activities, including maintenance, in order to ensure 
that they are carried out under specified conditions by: 



a) Establishing, implementing and maintaining 
documented procedure(s) to control situations 
where their absence could lead to deviations 
from the OH&S policy and the objectives and 
targets; 

b) Stipulating operating criteria in the 
procedures; and 

c) Establishing and maintaining procedure(s) 
related to the identified significant hazards 
and risks of goods and services used by the 
organization and communicating relevant 
procedures and requirements to suppliers and 
sub-contractors. 

4.4.6.1 Design and engineering 

The organization shall establish, implement and 
maintain procedure(s) to ensure that health and safety 
is considered at the initial design and planning phase 
to build risk controls at this point, lb ensure this, each 
stage of design cycle (development, review verification, 
validation and change) should incorporate hazard 
identification, risk assessment and risk control 
procedures. Appropriately competent people shall be 
allocated clear responsibilities to meet and verify health 
and safety requirements. Where the newly evaluated 
hazard cannot be eliminated or substituted for one that 
presents lower risks, engineering controls shall be 
adopted. When the product, process or workplace is 
redesigned this experience shall be considered in the 
design process. 

4.4.6.2 Purchasing 

The organization shall establish, implement and 
maintain procedure(s) for purchasing of goods and 
services including maintenance procedures under 
contract to others to ensure that purchased goods, 
services, and products and sub-contractors conform to 
the organization's OH&S requirements. 

4.4.7 Emergency Preparedness and Response 

The organization shall establish, implement and 
maintain procedure(s) for emergency preparedness and 
response, to plan for contingency in advance and to 
periodically test these plans to allow an adequate 
response to occur during the actual emergency. While 
planning the procedure for emergency preparedness it 
shall consider significant events such as fire, explosion, 
toxic release or natural disasters that threaten the 
viability of the organization. On-site and off-site 
emergency plans and procedures shall be developed 
and periodically tested, reviewed and revised, where 
necessary by the appropriate authority. Einergency 
plans of large installations should be prepared in 
consultation with municipal or state disaster planning 
authorities. 
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interaction, and reference to related 
documentation: 

d) Documents, including records, required by 
this Indian Standard; and 

e) Documents, including records, determined by 
the organization to ensure the effective 
implementation of OH&S management 
system. 

NOTE — !l is important that docunicnred procc\lures and work 
instructions ore treated with productivity in initid and with 
health ik safety matter integrated into each step and the design 
and review of such procedures are developed hy cosupeient 
people together with involvement from those required to 
perform the lask(s], vSucti documented procedures and work 
instructions arc commonly known as systems of work or 
standard operation procedure. 

4.4.5 Control of Documents 

The organization shall establish, impienient and 
maintain a procedurets) for controiling all documents 
required by the OH&S management sysier.;s and by 
this standard: 

a) Documents are approved for adequacy prior 
to issues; 

b) Documents are periodically reviewed, revised 
as and when necessary and re-approved for 
adequacy by authorized personnel; 

c) Changes and the current revision status of 
documents are identified; 

d) The current versions of relevant documents 
are available at all locations; 

e) Obsolete documents are promptly removed 
from all points of issue and points of use, or 
otherwise assured against unintended use; 

() Any obsolete documents retained for legal 
and/or knowledge preservation purposes are 
suitably identified; 

g) Documents remain legible, dated (with dates 
of revision) and readily identified; and 

h) Documents of external origin determined by 
the organization to be necessary for the 
planning and operation of the OH&S 
management systems are identified and their 
distribution controlled. 

Records arc special type of documents and shall be 
controlled in accordance with the requirement given 
in 4.5.4. 

4.4.6 Operational Control 

The organization shall identify those operations and 
activities that are associated with the identified 
significant hazards and risks in line with its policy, 
objecuves and targets. The organization shall plan these 
activities, including maintenance, in order to ensure 
(hat they are carried out under specified cc^nditions by: 



a) Establishing, implementing and maintaining 
documented procedure(s ) to control situations 
where their absence could lead to deviations 
from the OH&S policy and the objectives and 
targets; 

b) Stipulating operating criteria in the 
procedures; and 

c) Establishing and maintaining procedure(s) 
related to the identified significant hazards 
and risks of goods and services used by the 
organization and communicating relevant 
procedures and requirements to suppliers and 
sub-contractors. 

4.4.6.1 Design and engineering 

The organization shall establish, implement and 
maintain procedure(s) to ensure that health and safety 
is considered at the initial design and planning phase 
to build risk controls at this point. To ensure this;, each 
stage of design cycle (development, review verification, 
validation and change) should incorporate hazard 
identification, risk assessment and risk control 
procedures. Appropriately competent people shall be 
allocated clear responsibilities to meet and verify health 
and safety requirements. Where the newly evaluated 
hazard cannot be eliminated or substituted for one that 
presents lower risks, engineering controls shall be 
adopted. When the product, process or workplace is 
redesigned this experience shall be considered in the 
design process. 

4.4.6.2 Purchasing 

The organization shall establish, implement and 
maintain procedure(s) for purchasing of goods and 
services including maintenance procedures under 
contract to others to ensure that purchased goods, 
services, and products and sub-contractors conform to 
the organization's OH&S requirements. 

4.4.7 Emergency Preparedness and Response 

The organization shall establish, implement and 
maintain procedure(s) for emergency preparedness and 
response, to plan for contingency in advance and to 
periodically test these plans to allow an adequate 
response to occur during the actual emergency. While 
planning the procedure for emergency preparedness it 
shall consider significant events such as fire, explosion, 
toxic release or natural disasters that threaten the 
viability of the organization. On-site and off-site 
emergency plans and procedures shall be developed 
and periodically tested, reviewed and revised, where 
necessary by the appropriate authority. Emergency 
plans of large installations should be prepared in 
consultation with municipal or state disaster planning 
authorities. 
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The organization shall also establish and inanitain 
procedure(s) to mitigate the effects of such incidents 
on those directly suffering injury. These procedures 
shall include: 

a) Establishment of appropriate fust aid facihties 
that are matched to the site hazards and 
availability of further assistance. Sites remote 
from medical assistance shall have first aid 
appropriate to stabilize any injury until 
transported to such medical assistance; and 

h) Process to rehabilitate injured employees by 
providing appropriate rehabilitation as soon 
as practicable after the injury occurs, so that 
recovery from the injury is expedited. 

4.4.8 Critical Incident Recovery Plan 

The organization shall establish, implement and 
maintain procedures for Critical Incident Recovery 
Plan (CIRP) to aid in-piant employee reeovery as soon 
as possible after the cessation of the event. Only 
suitably qualified counsellors shall be used to assist 
victims associated with a traumatic event. 

NOTE — The C'lRP allows the plant lo mininiiyre Ihe time 
rcttuired lo return to norma! operations and in assist einpioyees 
who are not mjurcd but who have, for example, witnessed an 
incident, to cope up with the trauma. 

4.5 Checking 

4.5 . J Man ito ring and Mens a rement 

The organization shall establish, implement and 
maintain procedures to monitor and measure OH&S 
performance on a regular basis the key characteristics 
of its operations and activities that can have significant 
hazards and risks. These procedures shall provide for: 

a) both qualitative and quantitative nieastnes, 
appropriate to the needs of the organization; 

b) monitoring of the extent to which the 
organization's OH&S objectives arc met; 

c) proactive measures of performance that 
monitor compliance with the OH&S 
management programme, operational criteria 
and applicable legislation and regulatory 
requirements; 

d) reactive measures of performance to monitor 
accidents, ill health including health 
surveillance, incidents (including near- 
misses) and other historical evidence of 
deficient OH&S performance; and 

e) recording of data and results of monitoring 
and measurements sufficient to facilitate 
subsequent corrective and preventive action 
analysis. 

The organization shall establish, implement and 
maintain procedures for the calibration and 



maintenance of monitoring equipments used for 
performance measurement and monitoring. Records 
of calibration and maintenance activities and results 
shall be retained according to the organization's 
procedure. 

4.5.2 Evaluation of Compliance 

4.5.2.1 The organization shall establish, implement 
and maintain a procedure(s) for periodically 
evaluating compliance with legal requirements. The 
organization shall keep records of results of the 
periodic evaluation. 

4.5.2.2 The organization shall establish, implement 
and maintain a procedure(s) for periodically evaluating 
compliance with other requirements to which 
organization subscribes. The organization shall keep 
records of results of the periodic evaluation. 

^,53 Accident. Incident, Non-conformance, Corrective 
Of id Preventive Action 

The organization shall establish and maintain 
procedures for defming responsibility and authority for: 

a) The handling and investigation of: 

1) Accidents, 

2) Incidents, and 

3) Non-conformances; 

b) Taking action to mitigate any consequences 
arising from accidents, incidents or non- 
conformance; 

c) Initiation and completion of corrective and 
preventive action; and 

d) Confirmation of the effectiveness of corrective 
and preventive action taken. 

These procedures shall require that all proposed 
corrective and preventive actions shall be reviewed 
through the risk assessment process prior to 
implementation. 

Any corrective and preventive action taken to eliminate 
the causes of actual and potential non-conformances 
shall be appropriate to the magnitude of problems and 
commensurate with the OH&S hazards and risks 
encountered. 

The organization shall implement and record any 
changes in the documented procedures resulting from 
corrective and preventive actions taken, 

4,5.4 Control of Records 

The organization shall establish and maintain records 
as necessary to demonstrate conformity to the 
requirements of its OH&S management system and of 
this International Standard, and the results achieved. 

The organization shall establish, implement and 
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maintain a procedure(s) for the identification, 
storage, protection, retrieval, retention and disposal 
of records. 

Records shall be and remain legible, identifiable and 
traceable. 

4.5.5 Internal Audit 

The organization shall ensure that internal audits of 
the OH&S management system are conducted at 
planned intervals to: 

a) Determine whether the OH&S management 
system, 

1) conforms to planned arrangements for 
OH&S management including the 
requirements of this standard, 

2) has been properly implemented and is 
maintained; and 

b) Provide information on the results of audits 
to management. 

Audit programmes shall be planned, established, 
implemented and maintained by the organization, 
taking into consideration the OH&S importance of the 
operation(s) concerned and the results of previous 
audits. Audit procedure(s) shall be established, 
implemented and maintained that address: 



a) 



b) 



the responsibilities and requirements for 
planning and conducting audits, reporting 
results and retaining associated records, and 
the determination of audit criteria, scope, 
frequency and methods. 



Selection of auditors and conduct of audits shall ensure 
ohjectivity and the impartiality of the audit process. 



4.6 Management Review 

The organization's top management shall at intervals, 
that it determines, review the OH&S management 
system to ensure its continuing suitability, adequacy and 
effectiveness. The management review process shall 
ensure that the necessary information is" collected to 
allow management to carry out this evaluation. Reviews 
shall include assessing opportunities for improvement 
and the need for changes to the OH&S management 
system, including the OH&S policy, objectives and 
targets. Records of the management review shall be 
retained. The management review shall consider; 

a) Results of internal audits and evaluations of 
compliance with legal requirements and with 
other requirements to which the organization 
subscribes; 

b) Cornmunication(s) from external interested 
parties, including complaints; 

c) The OH&S performance of the organization, 

d) Extent to which objectives and targets have 
been met; 

e) Status of corrective and preventive actions, 
Follow-up actions from previous management 

reviews; 

g) Changing circumstances, including 
developments in legal and other requirements 
related to its health and safety; and 

h) Recommendations for improvement. 

The output from management reviews shall include 
any decisions and actions related to possible changes 
to OH&S policy, objectives, targets and other elements 
of the OH&S management system, consistent with the 
commitment to continual improvement. 
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ANNEX A 

[Foreword, and Clause 1) 

GUIDANCE FOR USE OF THE SPECIFICATION 



Al GENERAL REQUIREMENTS 

This Annex gives additional information on the 
requirements and is intended to avoid misinteq)retation 
of the specification. This Annex only addresses the 
OH&S management system requirements contained 
in 4. The introduction of Occupational health and safety 
(OH&S) management into the existing overall 
management system should be considered within a 
general management system model that incorporates 
the following principles (.see Fig. 1): 

a) Principle 1 Comtnitment and Policy — An 
organization should define its OH&S policy 
and ensure commitment to its OH&S 
management systems. 

b) Principle 2 Planning — An organization 
should plan to fulfil its OH&S policy, 
objectives and targets. 

c ) Principle 3 Implementation and Operation — 
For effective implementation, an organization 
should develop the capabilities and support 
mechanisiTT necessary to achieve its OH&S 
policy, objectives and targets. 

d) Principle 4 Measurement and Evaluation — 
An organization should measure, monitor and 
evaluate its OH&S performance and take 



preventive and corrective action, 
e) Principle 5 Management Review — An 
organization should regularly review and 
continually improve its OH&S management 
system, with the objective of improving its 
OH&S performance. 

In carrying out its OH&S commitment, an organization 
should aim at: 

a) Developing the capability to balance and 
resolve conflicts between OH&S and other 
organizational objectives and priorities, and 

b) Alignment/integration of OH&S into the 
overall business management process. 

Keeping this in mind, the management system is best 
viewed as an organizing framework that should be 
continually monitored and periodically reviewed, to 
provide effective direction for an organization's OH&S 
activities in response to changing internal and external 
factors. 

As organizations grow in experience, procedures, 
programmes and technologies can be put in place to 
further improve OH&S performance. As OH&S 
management system matures, OH&S considerations 
should be integrated into all its business decisions. 




Fro. 1 Elements of Heaitk and Safety MAhfAGEMENT 
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A-2 OH&S POLICY 

The organization's OH&S policy is a public statement 
signed by top management declaring its commitment 
and intent to manage its OH&S responsibilities. In 
publishing the policy the organization is sending a clear 
message that it has a vision for OH&S management 
within the whole organization. 

The policy should be relevant to the organization's 
overall vision and objectives. It should be dynamic and 
set the framework for continual improvement, 
especially in decision making. It should set out a 
programme of action for the whole organization, 
ensuring accountability and linking OH&S to the 
overall organizational values, objectives and processes. 
The policy is implemented through planning. 

This policy is intended to clearly tell employees, 
suppliers, customers and interested parties that OH&S 
is an integral part of all operations. IManagement being 
actively involved in the review and continual 
improvement of OH&S performance further reinforces 
this commitment- 

1: very one should be aware of the inHuence ihat their 
actions and inaction can have, on the effectiveness of 
the system. They can also participate in the 
establishment and maintenance of the OH&S controls, 
as well as assisting in the planning. 

Successful change can be accomplished by effective 
leadership in the areas of: 

a) Determining the organization's current 
position on OH&S; 

b) Resource allocation including setting budgets, 
responsibilities, authority and accountability; 

c) Coordinated management planning and 
agreed delegations; and 

d) Decisions followed through and performance 
assessed. 

Regular review of OH&S at senior management level 
reinforces its importance to the organizatit)n's success 
in meeting its commercial and legal obligations. 

A-2.1 The following questions can aid in establishing 
or rewriting an organization's OH&S policy: 

a) Integration and Relevance — h the policy 
integral and relevant to the organization's: 

1) mission statement, vision, core values 
and beliefs; 

2) overall management system; and 

3) activities, products and services. 

h) Accountability — Docs the OH&S policy 
address accountability in term„s of: 



1) capacity to assign/delegate, deliver, and 
review the policy's commitments; 

2) inclusion of OH&S accountability in all 
duty statements (reflecting the degree of 
legal responsibility); 

3) setting of objectives and targets to 
minimize incidents, injury, illness and 
incidents; and 

4) allocation of adequate resources to fulfil 
the aims of the policy. 

c) Consultation — Does the policy enable 
consultation with: 

1) employees; 

2) line managers; 

3) sub-contractors; and 

4) suppliers; 

A-3 PLANNING 

The initial OH&S review {see 4.3.1) of the 
organization's posiuon provides a planning framework 
for the implementation of the OH&S management 
system. While during inidal review all the hazards and 
risks are identified, in the process of planning the 
significant hazards and risks are recognized. 
Objectives, targets and performance indicators are 
established and plans are also made to achieve them. 

Planning needs to address schedules, resources and 
responsibilities for achieving the organization's OH&S 
objectives and targets. Such planning (and resulted 
plans) can cover a number of areas. For example: 

a) Plans to manage and control the initial 
implementation of an OH&S management 
system; 

b) Specific OH&S plans required for managing 
OH&S risks; 

c) Contingency plans required as part of the 
organization's emergency preparedness to 
meet foreseeable emergencies as well as plans 
to mitigate their effects (that is critical incident 
recovery, first aid and clean-up); 

d) Plans required to meet objectives and targets 
in measuring performance, undertaking audits 
and reviewing the system; and 

e) Response plans for dealing with corrective 
action identified as part of the incident 
investigation process or following the 
identificaUon of non-conformances. 

The level and complexity of planning should 
commensurate with the size, complexity and nature of 
the organization and the risks it has to manage. In 
smaller organizadons many of these types of plans may 
be combined. 
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A-3.1 Initial OH&S Review 

Every organization will find that it has some elements 
of an OH&S management system in place. What is 
less common is the Unking of these elements into a 
coordinated overall system for improvement. 

A useful starting point is to critically compare the basic 
intent of each element in this standard with 
management practices and procedures, v/hich are 
currently being used in the organization. Many 
organizations have obsolete procedures and need to 
compare the requirements of this standard with what 
actually occurs in order to obtain a realistic assessment 
of the implementation task. 

A-3.1.1 Core elements which could be initially focused 
on: 

a) Clear management responsibility for OH&S; 

b) Identification of all applicable legal 
requirements and their compliance; 

c) Hazard identification and risk assessment, and 
what is being done about them; 

d) Documentation of critical procedures; 

e ) OH&S inspections of critical procedures and 
plant; and 

f) Training. 

Other elements can be progressively implemented in 
accordance with organizational needs and priorities. 

A-3J.2 Some common techniques for initial review 
include: 

a) Questionnaires, 

b) Interviews with employees, 

c) Checklists, 

d) Direct inspection and measurement, 

e) Assessments (internal and external), 
Review of records, and 

g) Comparison with similar organizations. 

A-3.1. 3 External sources which may be able to help 
include: 

a) Government agencies in relation to laws and 
permits, 

b) Local or regional libraries or databases, 

c) Other organizations for exchange of 
information, 

d) Industry associations, 

c) Larger customer organizations, 

f) Suppliers of equipment, and 

g) Professional help. 

A-3.L4 Many organizations do not have a complete 
understanding of their legal responsibilities in relation 



to the many OH&S statutes, regulations, standards, 
codes of practice and guidance documents, which cover 
their area of operations. 

A-3.1. 5 LIseful sources of information include: 

a) Disease, incident and first aid records kept by 
the organization or by industry associations, 
governments and the like; 

b) Workers compensation experience. Insurance 
companies are often able to provide feedback 
on an organization's claims experience and 
the breakdown of the components of the 
insurance premium and how these compare 
within an industry group; and 

c) Other data an organization may hold on 
absenteeism, sick leave, industrial disputes 
and the like may provide indirect pointers to 
areas of poor OH&S management. 

A-3.2 Hazard Identification, Risk Assessment and 
Risk Control 

Hazard identification, risk assessment and risk control 
should be taken into account when plans are formulated 
to meet an organization's OH&S policy. All identified 
hazards are assessed to determine the level of risk, 
which is a measurement of the probability and possible 
consequence of injury and illness resulting from 
exposure to hazard. The final step involves risk control 
where risk is treated to reduce its level {see Fig. 2). 




Fig. 2 Hazard Tdkntification Asst::ssMtNT and 
Control of Risk 

A-3.2.1 Hazanildentificaiion 

Tools used to assist in the identification of hazards 
include: 

d) Consultation — People who may have 
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experience in aspects of the job that they hke 
least and may lead to hazardous activities. 

b) Inspection — A physical inspection of the 
work environment. 

c) Illness and injury records — Records of past 
incidents involving injury ,nid illness 
highlight sources of potential harm. 

d) In format ion! specialist advice — The 
identification of some hazards will require 
specialist advice, research and information. 

e) Task analysis — By breaking a task down into 
its individual elements hazards associated 
with the task can be i den tided. 

1) Formal hazard analysis systems, for example 
HAZOP/HAZAN. 

NOTE — IS 3786 prescribes methods of coiriputalioii of 
frequency and severity rales for industrial injuries and 

cIaj,sification of industrial accidents. This Indian Standard may 
also be useful in the process of identification of hazard. 

A-3.2,2 Risk Assessment and Control 

In order to corry out risk assessment, the level of risk 
is determined first. Establishing the level of a risk 
requires clear specification of the actual components 
of the risk being considered, for example, the specific 
scenario of sequence of events including the nature of 
consequences to be considered, the exposure to the 
chosen hazard, finally the probability or likelihood of 
that scenario taking place. (In doing so the existing 
controls are determined when exposure is assessed.) 

Any scenario involving particular hazard can lead to 
different consequences depending on the sequence of 
exposure events. Hence any risk level needs to be 
assessed separately for each chosen sequence of events. 
To combine the following three components of any 
risk in assessing its ieveh 

a) Choose a specific consequence or outcome 
severity for one possible sequence of events 
involving the hazard under consideration. OtJier 
possible sequences with different possible 
consequences need to be assessed separately. 
Ihe number of persons harmed and the nature 
of their injuries/illness affects tlie estimation of 
the consequence or outcome severity; 

b) Determine the exposure for the chosen 
sequence, that is how often (frequency); how 
long duration of the affected persons exposed 
to the particular hazard; and 

c) Estimate the probability, likelihood or chance 
that the chosen scenario will lead to the 
specific consequences being considered. 
Every scenario that is considered for any 
particular hazard has its own specific risk 
level. The integrity and effectiveness of any 



existing risk control measures will need to be 
included in estimating probability, 

EliiTiination/substitution is a permanent solution and 
.should be attempted in the first instance. The hazard is 
either eliminated altogether or substituted by one that 
presents a lower risk. This could involve the elimination 
of a hazardous process or substance or the substitution 
of a toxic substance with a less toxic substance. 

NOTE — For the purpose of identification of hazard and 
assessment and control of risks a guideline has been given in 
Annex C. 

Risk= Consequence x Exposure x Probability 

Level The outcome Frequency and Likelihood or 

severity duration of chance that 

(injury/illness) exposure of the chosen 

of one scenario persons to the sequence and 

chosen hazard consequence 

will occur 

Elimination/substitution is a permanent solution and 
should be attempted in the first instance. The hazard is 
either eliminated altogether or substituted by one that 
presents a lower risk. This could involve the elimination 
of a hazardous process or substance or the substitution 
of a toxic substance with a less toxic substance. 

NOTE — For the purpose of identification of hazard and 
assessment and control of risks a guideline has been given in 
Annex C of this standard. 

A-3.3 Legal and Other Requirements 

In maintaining regulatory compliance, an organization 
should identify and understand regulatory requirements 
applicable to its activities, products or services. 
I^egulations cover several aspects such as: 

a) Those specific to the activity (for example 
confined spaces regulations); 

b) Those specific to the organization's products 
or services; 

c) Those specific to the organization's industry; 

d) General OH&S laws; and 

e) Authorizations, licences and permits. 

Several sources can be used to identify OH&S 
regulations and ongoing changes, including: 

a) All levels of government; 

b) Industry associations or groups; 

c) Commercial databases; and 

d) Professional services. 

To facilitate keeping track of legal requirements, an 
organization can establish and maintain a list of all 
laws and regulations pertaining to its activities, 
products or services and the same should be updated 
on a regular basis. 
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A-3,4 Objectives, Targets, Performance Indicators 
and Pogramme(s) 

Objectives state what is intended to be accomplished 
and targets define a performance level timeframe. 

Objectives should be aimed at broad level 
improvements in the OH&S performance and the 
targets should be qualified wherever practicable in the 
following terms: 

a) Attributes — things which are major (handling 
injuries and adequately guarded machine); 

b) Scale — against which the attributes can be 
measured; 

c) Goal — describing what is to be achieved; 
and 

d) Time scale — in which it is to be achieved. 

Performance indicators are the means by which it is 
measured whether expected outcomes meet objectives. 
There are measures such as rates, ratios or indices 
which reflect how well the OH&S management system 
or its elements arc performing. 

Combining targets and performance indicators 
produces objectives that are specific, measurable, 
achievable, reahstic and time-bound. 

For example: 

Objective Implement an OH&.S management system 

Targc't Full implementation within six months 

Indicator Percentage of departmental meeting audit 
criteria 

(Objective : All business units to fully meet system 
audit criteria within six months.) 



Objective Reduce injuries associated with manual 
handling 

Target 20 percent reduction from previous year 

Indicator Percentage of manual handling injuries 
per year 

(Objective : Reduce the percentage of manual 
handling injuries by 20 percent from the 
previous year in the next 12 months.) 

When considering their technological options, an 
organization may consider the use of the best available 
technology where economically viable, cost effective 
and judged appropriate. Review of objectives and 
targets should be based on past performance and in 
consultation with workplace personnel, OH&S 
professionals, insurers and other appropriate persons 
01 groups. When the objectives and targets are set, the 



organization should consider establishing measurable 
OH&S performance indicators. These indicators 
should be used as a basis for an OH&S performance 
evaluation system and to provide information on both 
the OH&S management and operation systems. 

The creation and use of one or more programmes is a 
key element to the successful implementation of an 
OH&S management system. The programme should 
describe how the organization's objectives and targets 
will be achieved, including time, skill and personnel 
responsible for implementing the organization's OH&S 
policy. This programme may be subdivided to address 
specific elements of the organization's operations. The 
programme should include an OH&S review for new 
activities. 

The programme may include, where appropriate and 
practicaK consideration of planning, design, 
production, marketing and disposal stages. This may 
be undertaken for both current and new activities, 
product or services. For products this may address 
design, materials, production processes, use and 
ultimate disposal. For new installation or significant 
modification of processes this may address planning, 
design, construction, commissioning operation and at 
the appropriate time as determined by the organization, 
de-commissioning. 

A-4 IMPLEMENTATION AND OPERATION 

A-4.1 Resources, Roles, Responsibility and Authority 

A-4.1.1 In organizing the implementation and effective 
management of its OH&S policy an organization 
should: 

a) Allocate adequate resources commensurate 
with its size and nature; 

b) Identify the competencies required at all levels 
within the organization and organize any 
necessary training; 

c) Make arrangements for the effective 
communication of OH&S information; 

d) Make effective arrangements for the 
provisions of specialist advice and services; 

e) Make effective arrangements for 
handicapped, aged, visitors and foreign 
employees and/or special category of 
employees; and 

Make effective arrangeinents for employee 
concentration and active involvement. 

A-4. 1.2 The resource base, structure, and size of 
organizations may impose constraints on 
implementation. In order to overcome these constraints 
external health and safety resources may need to be 
utihzed. Such resources might include: 
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a) Shared technology and experience from larger 
client organization; 

b) Cooperative approaches to develop industry 
specific guidance material and strategies; 

c) Support from industry and empiuyce 
associations or principal sub-contractors and 
owners; 

d) Assistance from government healih and safety 
organizations; 

c) Use of consultants and the collective 
engagement of consuUants; 

f) Provision of advice and training from 
suppliers; 

g) Assistance provided by workers' 
compensation insurance agents; 

h) Attendance at health and safety seminars; and 
j) Manually beneficial support from universities 
and other research centers. 

Organizations should focus on utilizing cooperative 
strategies to implement and maintain an effective 
OH&S management system. 

A-4. 1.3 Improving health and safety is most effective 
when people from all levels of the organization are 
encouraged to participate in the development and 
implementation of the programme. People are more 
likely to embrace change if it is not imposed upon them. 

At all levels of the organizations, people should be: 

a) Responsible for the health and safety of those 
they manage, themselves and others with 
whom they work; 

b) Aware of the responsibility for the health and 
safety of people who may be affected by the 
activities they control, for example sub- 
contractors and public; and 

c) Aware of the influence that their action or 
inaction can have on the effectiveness of the 
OH&S management systems. 

A-4. 1,4 Senior management should demonstrate, their 
commitment being actively involved in the continual 
improvement of OH&S performance. While ultimate 
responsibility for OH&S rests with the employer, the 
following also need to be ensured: 

a) A person at the senior management level 
should be assigned particular responsibility 
for ensuring that the OH&S management 
system is implemented and performs to 
expectations, in all locations within the 
organizations; 

b) To recognize that knowledge nwd experience 
throughout the workforce is a valuable 
resource and it should act to encourage and 



delegate responsibilities and authorities for the 
development and implementation of the 
OH&S management system for all key 
functional areas; and 
c) A defined system of implementing and 
communicating any change of responsibility 
and authority. 

It should be recognized that effective management of 
OH&S requires the support and commitment of the 
employees, and that the knowledge and experience of 
the workforce can be a valuable resource in the 
development and operation of the OH&S management 
system. 

A-4.2 Competence, Training and Awareness 

The effective implementation and maintenance of an 
OH&S management system is dependent on the 
competencies and training of an organization's people. 

A-4.2.2.1 The top management of an organization 
should demonstrate its commitment to OH&S through 
consultation with and where appropriate, its employees 
and other relevant individual(s) or groups in the 
development, implementation, and maintenance of its 
OH&S management systems. The objectives and 
targets should be understood and supported by the 
organization's employees and they should be 
encouraged to accept the importance of their 
achievements both in terms of the organization's 
OH&S performance and the benefits, to the 
environment in which they work. Employees should 
be made aware of exposure to possible harm or injury 
in their work environment including physical, 
chemical, ergonomic, radiation, biological and 
psychological hazards. They should have an 
understanding of these hazards as they relate to their 
work environment and be able to recognize and take 
action to prevent work practices or activities likely to 
leave to incidents. 

A-4.2.2.2 OH&S competency standards should be 
developed by: 

a) Using existing industry competency standard, 

b) Examining job or position descriptions, 

c) Analysing work tasks, 

d) Inspection and audits of hazards identification 
and risk analysis, and 

Reviewing incident reports. 

The organization should develop training programme 
after the assessment of current capability against the 
required competency profile. An organization should 
also establish and maintain documented procedures for 
evaluation of training provided to its workers and its 
effectiveness. 
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A-4,2.2.3 Generally a health and safet} training 
programme should cover but are not hmited to the 
following aspects: 

a) Health and safety poHcy of the organization, 

b) Way in which health and safety is organized 
in tine workplace, 

c) Health and safety procedures in the 
organization, 

d) Specific hazards and risk controls, 
c) OH&S legislation, and 

f) Bniergency procedures. 

A -4.2.2.4 A training programme may need to address 
a number of target groups including: 

a) Senior management; 

b) Line managers/supervisors; 

c) Employees; 

d ) Those with specific responsibilities (first aid, 
fire, elected health and safety representatives); 

c) Sub-contractors; 

Operators who require certificates under 
legislation; and 

g) Site visitors. 

A-4. 2.2.5 Training records should normally include: 

a) Information about those who have been 
trained, 

b) What the training course covered, 

c) When the training took place, 

d) Who provided the training, and 

e) Feedback from trainees. 

A-4.2.2.6 OH&S training is typically provided at 
certain key times in an operational cycle inckiding: 

a) At induction for new employees, 

h) When employees are transferred to new jobs, 

c ) On movement into managerial or supervisory 
positions, 

d) On engagement of sub-contractors. 

ei When modification in the system is carried 
out, and 

f) After a time gap as a refresh. 

A-4.3 Communication and Reporting 

.A "4 .3 . 1 Co mm un ication 

Organizations should implement a procedure for 
receiving documenting and responding to relevant 
information and requests from interested parties. The 
procedure may include a dialogue with interested 
panics and consideration of their relevant concern. In 
some circumstances, response to interested parties' 
concerns mav include relevant in format;! on about the 



hazards and risks associated with the organization's 
operations. These procedures should also address 
necessary coinmunication with public authorities 
regarding emergency planning and other relevant 
issues. Organizations should also have a system to 
communicate relevant OH&S information including 
objectives and targets and any change in delegation of 
responsibility to its own employees. 

A-4. 3*1.1 Commonly used methods of internal 
communication include: 

a) Bulletins, 

b) News letters, 

c) Notice boards; 

d) Signage, 

e) Videos, 

f) Minutes/action notes of the meetings, 

g) Team briefings, and 

h) Hard copy or electronic mail. 

A-4. 3. 1.2 Commonly used methods of external 
communication includes: 

a) Annual reports, 

b) Publications, 

c) Inserts in industry publications, 

d) Paid advertising, 

e) Telephone inquiry services, 

f) Submissions to government, and 

g) Websites. 

A -4.3.2 Reporting 

Traditionally reporting has focused on lost-time injuries 
and not the management system established to control 
risks. Effective reporting should cover the positive steps 
the organization is taking to identify hazards and 
control risks and can include reports: 

a) of levels of conformance with procedures, 

b) on performance against targets, 

c) on improvements made, 

d) on underlying reasons for incident 
occurrences, 

e) on results of safety inspections and audits; 
on health monitoring, and 

g) of workplaces monitoring. 

A-4,4 Documentation 

Documentation is an important element in enabling 
an organization to implement a successful OH&S 
management system. It is also important in assembling 
and retaining OH&S knowledge, but it is important 
that documentation is kept to the minimum required 
for effectiveness and efficiency. 
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A-4AI Organizations should ensure thai sufficient 
documentation is available to enable OH&S plans to 
be fully implemented and is proportional to their needs. 

A-4.4.2 Operational processes and procedures should 
be defined and appropriately documented and updated 
as necessary. The organization should clearly define 
the various types of documents, which cstabhsh and 
specify effective operational procedures and control. 

A-4.4.3 The existence of OH&S management systems 
documentation supports employee awareness of what 
is required to achieve the organization's OIT&S 
objectives and enables the evaluation of the system and 
OH&S performance. 

A-4.4.4 The degree and quality of the documentation 
will vary depending on the size and complexity of the 
(organization. Where elements of the OH&S 
inanagcmciii systems arc integrated with an 
organization's overall management system the OH&S 
documentation should be integrated into existing 
documentation. The organizations shoi.ild consider 
organizing and maintaining a summary of the 
documentation to; 

a) Collate the OH&S policy, objectives and 
targets; 

b) Describe the means of achieving OH&S 
objectives and targets: 

c) Document the key roles, responsibilities and 
procedures; 

d) Provide direction to related documentation 
and describe other elements of the 
organization's management system, where 
appropriate; and 

e) Demonstrate that the OH&S management 
system elements appropriate for the 
organization are implemented. 

A-4,5 Control of Documents 

OH&S documents communicate standiu'ds and regulate 
action. They should be current, comprehensive and 
issued by an authoritative source. The organization 
should ensure that: 

a) Documents can be identified with appropriate 
organization, division, functioii, activity or 
contact person; 

b) Documents are periodically reviewed, revised 
as necessary and approved by authorized 
personnel prior to issue; 

c) The cuirenl version of relevant documents are 
available at all locations where operations 
essential to the effective functioning of the 
system are performed; and 

d) Obsolete documents are promptly removed 
from all points of issue. 



Documents can be in any medium as long as they are 
accessible, useful and easily understood. 

A-4.6 Operational Control 

It is important that OH&S, in its broadest sense, is fully 
integrated across the organization and into all its 
activities, whatever the size or nature of its work. In 
organizing for the implementation of the policy and 
the effective management of OH&S, the organization 
should make arrangements to ensure that activities are 
carried out safely and in accordance with arrangements 
and should: 

a) Define the allocation of responsibilities and 
accountabilities in the management structure, 

b) Ensure people have the necessary authority 
to carry out their responsibilities, and 

c) Allocate adequate resources commensurate 
with its size and nature. 

Some typical activities, which are covered under 
operational control are: 



a) 


Production, 


b) 


Maintenance, 


c) 


Storage, 


d) 


Handling, 


e) 


Packaging, Und 





Transportation. 



However this list is not an exhaustive list and may be 
' suitably modified depending upon the activities of the 
organization. Some examples of areas in which risks 
typically arise, and some examples of control measures 
against them are given below: 

a) Hazardous tasks 

This includes the following: 

1) Identification of hazardous tasks, 

2) Pre-determination and approval of 
working methods, 

3) Pre-qualification of personnel for 
hazardous tasks, and 

4) Permit-to-work systems, and procedures 
controlling the entry and exist of 
personnel to hazardous work sites. 

b) Hazardous materials 

This includes the following: 

1) Identification of inventories, and storage 
locations; 

2) Safe storage provisions and control of 
access; and 

3) Provision and access to material safety 
^^^ data and other relevant information- 
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c) Maintenance of safe plant and equipment 
This includes the following: 

1 ) Provision, control and maintenance of the 
organization's plant and equipment; 

2) Provision, control and nnaintenance of 
PPE; 

3) Segregation and control of access; and 

4) Inspection and testing of OH&S related 
equipment and high integrity systems 
such as: 

i) operator protection systems; 

ii) guarding and physical protection; 

iii) shutdown systems; 

iv) fire detection and suppression 
equipment; 

v) handling equipment (cranes, 
forklifts, hoists and other lifting 
devices); 

vi) radiological sources and safeguards; 

vii) essential monitoring devices; 

viii) local exhaust ventilation systems; 
and 

ix) medical facilities and provisions. 
A-4.6.I Desii^n and Engineering 

Engineering controls involve some structural change 
to the work environment or work process to place a 
barrier to, or interrupt the transmission path between 
the worker and the hazard. This may include machine 
guards, isolation or enclosure for hazards, tlie use of 
extraction ventilation and manual handling devices. 

Prospective hazard involving processes or services. may 
he identified at the design stage in consultation with 
various professionals, for example, engineers, 
architects, doctors or heahh and safety professionals. 
The risk associated with these hazards may he 
controlled hy appropriate design, sitting and selection 
of premises including: 

a)- Proposed use, foreseeable uses and future 

maintenance; 
h) Construction in a manner incorporating best 

health and safety practices; and 
c) Checking compliance to contract 

specifications. 

\ -4,6.2 Purchasing 

The organization needs to ensure that a policy has been 
developed for the employment of sub-contractors who 
undertake work on the employer's premises or assets, 
or who cany out work under the supervision and control 
of the employer. The organization also needs to satisfy 
Itself that its policy, plans and procedures for sub- 



contractors have been communicated to line managers, 
supervisors and other employees to ensure tliey ai*e aware 
of their role and responsibilities in the management, 
supervision and control of sub-contractors. 

A-4.6.2.1 The organizations should maintain a register 
of preferred sub-contractors that have established and 
maintained effective OH&S systems and prcictices. 

A-4.6.2.2 The organizations should select sub- 
contractors on their ability to meet the organization's 
OH&S requirements. A sub-contractor's ability to meet 
these requirements can be assessed in accordance with: 

a) Their OH&S pohcy; 

b) Project work-plans and work method 
statements; 

c) Competency; 

d) Registration and licenses (where applicable); 

e) Agreement to comply with the employers 
OH&S policy for sub-contractors; 

Verification (by inspection and tests) that 
work areas, work methods, materials, plant 
and equipment comply with health and safety 
legislation, regulations, standards and codes; 
and 

g) Identification and allocation of human, 
technical resources adequate to meet those 
requirements. 

A-4.6.2.3 Organizations should be capable of 
demonstrating not only their own commitment to 
OH&S and how they intend to ensure compliance with 
the organization's requirements, but also: 

a) That their sub-contractors and suppliers are 
selected on the basis of their ability to comply 
with OH&S requirements; 

b) How they interface with their sub-contractors/ 
suppliers of materials, equipment and 
services; and 

c) That their contract binds their subcontractors 
to ensuring that OH&S requirements will be 
met, and includes verification provisions for 
inspections, testing, auditing, reviewing and 
documentation. 

A-4. 6.2-4 The organization needs to ensure that 
personnel responsible for reviewing OH&S aspects of 
contracts for goods and services have suitable OH&S 
skills and experience. The review system should 
include procedures verifying that purchased goods and 
services conform to specified requirements. The 
organizadon may also use the identificadon, as.sessment 
and control approach and may involve those directly 
affected employees, OH&S clients, sub-contractors 
while introducing goods and services into the 
workplace. 
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Purchasing documentation should: 

a) list preferred suppliers, 

b) show the decision making process, including 
risk assessment through receipt of purchased 
goods/services, and 

c) be retained as part of the organization's 
records. 

A -4,7 Emergency Preparedness and Response 

The organization should develop an emergency plan(s), 
identify and provide appropriate emergency 
equipment, and regularly test its response capability 
through practice drills. 

Practice drills should aim to test the effectiveness of 
the most critical parts of the emergency p!an(s) and to 
test the completeness of the emergency planning 
process. While desktop exercises can be useful during 
the planning process, practice drills should be as 
realistic as possible to be effective. This can require 
full-scale incident simulations to be conducted. 

The results of emergencies and practice drills should 
be evaluated, and changes that are identified as being, 
necessary sliould be implemented. 

A -4.7.1 Emergency Plan 

The emergency plaii(s) should outline the actions to 
be taken when specified emergency situations arise, 
'c\wi\ should include the following: 

a) Identification of j)otcntial accidents and 
emergencies; 

b) A list of key personnel — identification of the 
persons to take charge during the emergency; 

c) Details of actions to be taken by personnel 
during an emergency, including those actions 
to be taken by external personnel who are on 
the site of the emergency, such as contractors 
or visitors (who can be required, for example, 
to move to specified assembly points); 

d) Emergency organization and 
responsibilities — responsibility, authority 
and duties of personnel with specific roles 
during the emergency (for example, fire- 
wardens, first-aid staff, nuclear leak/toxic 
spillage specialists); 

e) Evacuation procedures; 

f) Identification and location of hazardous 
materials, and emergency action required; 

g) An internal and external communication plan: 

1) interface with external emergency 
services; details of emergency services 
(for example, fire brigade, medical 
services, spill clean-up services); 



2) communication with statutory bodies; 

3) communication with neighbours and the 
public; 

h) Training plans and testing for effectiveness; 
j) Conducting emergency and fire drill 

periodically for testing the effectiveness of the 

plan; 
k) Protection of vital records and equipment; 
m) Availability of necessary information during 

the emergency for example plant layout 

drawings, hazardous material data, 

procedures, work instructions and contact 

telephone numbers; 
n) Installation or availability of suitable warning 

and alarm systems tested at regular intervals; 

and 
p) Emergency rescue equipment available and 

maintained in good working order. 

The involvement of external agencies in emergency 
planning and response should be clearly documented. 
These agencies should be advised as to the possible 
circumstances of their involvement and provided with 
such information as they require to facilitate their 
involvement in response activities. 

A-4,7.2 Emergency Equipment 

Emergency equipment needs should be identified, and 
equipment should be provided in adequate quantity. 
This should be tested at specified intervals for 
continuing operability. 

Examples include the following items: 

a) Alarm systems; 

b) Emergency lighting and power; 

c) Means of escape; 

d) Safe refuges; 

e) Critical isolation valves, switches and cut- 
outs; 

Fire-fighting equipment; 

g) First aid equipment (including emergency 

showers, eye wash stations, etc); and 
h) Communication facilities. 

A-4,73 Practice Drills 

Practice drills should be carried out according to a pre- 
determined schedule. Where appropriate and 
practicable, the participation of external emergency 
services in practice drills should be encouraged. 

A-4.8 Critical Incident Recovery Plan (CIRP) 

The CIRP should cover: 

a) Responsibilities, including coordination and 
initiation; 
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b) Defusing where those involved in the trauma 
can discuss the event immediately afterwards 
in a confidential atmosphere; 

c) De-briefmg, designed to assist employees use 
their own abilities to overcome emotional 
effects of serious incidents; 

d) Counselling, where further therapy may be 
required on an ongoing basis, assistance may 
also have to be provided to the families of 
directly or indirectly affected victims; and 

c) Legal and insurance requirement for example, 
interference without loss adjuster approval 
can invalidate the insurance policy. 

A-5 CHECKING 

A'5.1 Monitoring and Measurement 

An organization should measure, monitor and evaluate 
its 0H&5 performance, and take preventive and 
corrective action. Where appropriate, monitoring 
schemes for significant hazards should be in place. 
Broadly, such hazards may be classified as being either 
of the following: 

a) Physical, for example, noise, radiation, 
extremes of temperature; or 

b) Chemical, for example, toxic, flammable or 
explosive. 

A-5. 1.1 Monitoring may take the following forms: 

a) Environmental, for example, flammable gases. 

b) Personal, for example, noise dosimetry, 
personal respirable dust sampling. 

c) Biological, for example, heavy metals in 
blood or urine. 

d) Measurement of health outcomes, for 
example, audiometry and spirometry. 

Procedures should be in place for action when results 
do not conform with exposure standards or limits or 
show abnormal trends. Due care .should be taken and 
[procedure should be in place for calibration of 
inspection and testing equipment. 

A-5.2 Evaluation of Compliance 

The organization should be able to demonstrate that it 
has evaluated compliance with the legal requirements 
identified, including applicable permits or licences. 

The organization should be able to demonstrate that it 
lias evaluated compliance with the other identified 
requirements to which it has subscribed. 

A-5. 3 Accident, Incident, Non-conformance, 
Corrective and Preventive Action 

In establishing and maintaining procedures for 



investigating and correcting non-conformance, the 
organization should include these basic elements: 

a) Identifying the cause of the non-conformance; 

b) Identifying and implementing the necessary 
corrective action; 

c) Implementing or modifying controls 
necessary to avoid repetition of the non- 
conformance; and 

d) Recording any changes in written procedures 
resulting from the corrective action. 

Depending on the situation, this may be accomplished 
rapidly and with a minimum of formal planning or it 
may be a more complex and long-term activity. The 
associated documentation should be appropriate to the 
level of corrective action. 

A -5.4 Control of Records 

Records are a means by which the organization can 
demonstrate compliance with the ongoing OH&S 
management systems and should cover: 

a) external (for example, legal) and internal (that 
is OH&S performance) requirements; 

b) work permits; 

c) OH&S risks and hazards; 

d) OH&S training activity; 

e) inspection, calibration and maintenance 
activity; 

f) monitoring data; 

g) details incidents reporting, complaints and 
follow-up action; 

h) product identification including composition; 
j) supplier and sub-contractor information; and 
k) OH&S audits and reviews. 

The effective management of these records is essential 
to the successful implementation of the OH&S 
management system. The key features of good OH&S 
information management include; means of 
identification, collection, indexing, filing, storage, 
maintenance, retrieval, retention and disposition of 
perdnent OH&S management system documentation 
and records, OH&S records should be legible, 
identifiable and traceable to the activity, product or 
service involved. OH&S records should be stored and 
maintained in such a way that they are readily 
retrievable and protected against damage, deterioration 
or loss. Their retention times should be established and 
recorded. OH&S records include, among others, the 
following: 

a) Safety organization chart; 

b) Training records on safety fire and first-aid; 

c) Record of plant safety inspections; 

d) Accident investigation reports; 
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e) Accidcius unci dangerous occurrences- 
statistics and analysis; 

Record of tests and examinations of 
equipment and structures as per statutes; 

g) Safe operating procedures for various 
operations; 

h) Record of work perrnits; 

J) Record of monitoring of flammable and 
explosives substances at workplace; 

k) Maintenance and testing records of fire 
detection and fire fighting equipment; 

m) Medical records of employees; 

n) Records of industrial hygiene surveys (noise, 
ventilation and levels, illumination levels, 
airborne and toxic substances, explosive 
gases); 

p) Material safety data sheets; 

q) On-site ctnergency plans and record of mock 

drills; 
r) Records of waste disposal; 
s) Housekeeping inspection records; 

I) Minutes of safety committee meetings; 

u) Records of any modifications carried out 

inplant or process; 
v) Calibration and testing records; 
w) Inspection books and other statutory records; 

and 
y) Records of previous audits. 

A-5.5 Internal Audit 

The audit programme and procedure should cover: 

a) Activities and areas to be considered in audits, 

b) Frequency of audits, 

c) Responsibilities associated with managing 
and conducting audits, 

d) Commimication of audit results, 

e) Auditor coiTipetence, and 

How audits will be conducted? 

Audits may be performed by personnel from within 
the organization and/or external persons selected by 
the organization. In either case, the persons conducting 



ihe audit should be in a position to do so itiipartially 
and objectively. 

A-6 MANAGEMENT REVIEW 

The organization shall review at appropriate intervals 
the OH&S system so us to ensure continuing suitability, 
adequacy and to ensure continuing suitability, 
adequacy and effectiveness. The results of such review 
should be documented as wel! as published if the 
organization has a commitment to do so. 

Management reviews shall generally include but not 
limited to: 

a) assessment of the internal audit results; 

b) review of corrective actions; 

c) review of suggested changes; 

d) monitoring of the system; and 

e) review of policy, objectives and targets. 

Management review is a cornerstone of the 
management system providing an opportunity for 
senior management to regularly review the operation 
of the system and its continuing suitability in the face 
of change and to make adjustments to build upon and 
improve its elTectiveness. lypically the review would 
be conducted quarterly, six-monthly or 12-monthly. 

Some organizations prefer to incorporate the review 
into a regular senior management meeting to build on 
the principle that OH&S management should be 
integrated into hne management activities. 

Some organizations, recognizing the importance of 
employee involvement in the process, choose to use 
the mechanism of the central workplace committee 
where senior management and employee representative 
members conduct the periodic review. 

Yet again others prefer to hold separate management 
review meetings, with suitable participants, where no 
other business will distract from the review pv kcss. It 
is important to ensure that feedback on OH&S 
performance is gathered from employees and other 
relevant stakeholders. Equally employees and other 
stakeholders should be kept informed of changes and 
improvements flowing from the review process. 



IS 18001:2007 



ANNEX B 

(Foreword) 

COMPARISON OF IS 18001 : 2007 WITH IS/ISO 9001 : 2000 AND IS/ISO 14001 : 2004 



rS/lSO 14001 Elements 


OH&S (IS 18001) Elements 


IS/ISO 9001 Elements 


4*1 General Requirements 


4.1 General Requirements 


4.1 General Requirements 


4.2 Environmental Policy 


4.2 OH&S Policy 


5.3 Quality Policy 


4.3 Planning {Title only) 


4J Planning {Title only) 


5.4 Planning {Title only) 




4,3.1 Initial OH&S Review 




43 A Environmental Aspects 


4.3.2 Hazard Identification, Risk 
Assessment and Risks Control 


5.2 Customer Focus 

7.2.1 Determination of 
Requirements Related to the 
Products 

7.2.2 Review of Requirements 
Related to the Products 


4.3.2 Legal and Other 
Rajuircments 


4.3.3 Legal and Other Reqidrements 


5.2 Customer Focus 
7.2.1 Determination of 
Requirements Related to the 
Products 


4,3.3 Objectives and Targets 
^ and Programme(s) 


4.3.4 Objectives, Targets, 
Performance Indicators and 
Frogramme(s) 


5.4.1 Quality Objectives 

5.4.2 QMS Planning 


4,4 Implementation and 
Operation {Title only) 


4.4 Implementation and Operation 
{Title only) 


1 Product Realization {Title only) 


4.4.1 Resources, Roles, 
Responsibility and Authority 


4.4.1 Resources, Roles, Responsibility 
and Authority 


5.1 Management Commitment 

5.5.1 Responsibility and Authority 

5.5.2 Management Representative 
6.1 Provision of Resources 

6.3 Infrastructure 


4.4.2 Competence, Training 
and Awareness 


4.4.2 Competence, Training and 

Awareness 


6.2.2 Competence, Awareness and 
Training 




4.4.3 Communication and Reporting 
(Title only) 




4.4.3 Commumcadon 


4.4.3.1 Communication 


5.5.3 Internal Communication 
7.2.3 Customer Communication 




4.4.3.2 Reporting 




4.4.4 Documentation 


4.4.4 Documentation 


4.2.1 {Documentation 
Requirements) General 


4.4.5 Control of Documents 


4.4.5 Control of Documents 


4.2.3 Control of Documents 


4.4.6 Operational Control 


4.4.6 Operational Control 


7.5.1 Control of Production and 
Service Provision 




4.4,6.1 Design and engineering 


7.3 Design and Development 




4.4.6.2 Purchasing 


7,4 Purchasing 


4,4.7 Emergency Preparedness 
and Response 


4.4.7 Emergency Preparedness and 
Response 






4.4.8 Critical Incident Recover}' Plan 




4*5 Checking (Title only) 


4.5 Checking (Title only) 


8 Measurement, Analysis and 
Improvement {Title only) 
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IS/ISO 14001 Elements 


OH&S (IS 18001) Elements 


IS/ISO 9001 Elements 


4.5.1 Monitoring and 
Measurement 


4.5. 1 Monitoring and Measurement 


7.6 Control of Monitoring and 
Measuring Devices 

8.1 (Measurement, Analysis 
& Improvement) General 

8.2 Monitoring and 
Measurement 

8.2.3 Monitoring and 
Measurement of Processes 

8.2.4 Monitoring and 
Measurement of Product 


4.5,2 Evaluation of Compliance 


4,5,2 Evaluation of Compliance 




4.5.3 Nonconformity, Corrective 
Action and Preventive Action 


4.5.3 Accident, Incident, Non- 
Conformance, Corrective and 
Preventive Action 


8.3 Control of Non- 
conforming Products 

8.5.2 Corrective Action 

8.5.3 Preventive Action 


4.5.4 Control of Records 


4,5,4 Control of Records 


4.2 A Control of Records 


4,5.5 internal Audit 


4.5.5 Internal Audit 


8.2.2 Internal Audit 


4.6 Management Review 


4.6 Management Review 


5.6 Management Review 
{Title only) 

5.6.1 General 

5.6.2 Review Input 

5.6.3 Review Output 

8.5.1 Continual Improvement 
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ANNEX C 

(Foreword, and Clause A-3.2.2) 

(;i IDKLINF.S FOR HAZARD IDENTIFICATION AND ASSESSMENT AND CONTROL OF RISK 



C-1 APPLICATION 

All employers and self-employed people have a legal 
duly to assess the risks from their work activities. The 
risk assessment procedure described in this standard 
is intended to be used: 

a) for situations where hazards appear to pose a 
significant threat and it is uncertain whether 
existing or planned controls are adequate in 
principle or in practice; and 

b) by organizations seeking continuous 
improYcmeni in their OH&S management 
systems^ in addition to mininuim legal 
requirenients. 

The full procedure described in this standard is not 
necessary or cost-effective when it is quite clear from 
prclnivinary study that risks are trivial, or a previous 
assessment has shown that, existing or planned 
controls: 

a) conform to the legal requirements as well as 
established standards; 



b) are appropriate for the tasks; and 

c) are, or will be, ijnderstood and usee 
everyone concerned. 



by 



WcTQ no further action is required other than to ensure, 
that c<Mitrols continue to be used. Small, low risk 
organizations in particular should be highly selective 
in the risks that they choose to assess in detail. 

Effort developed for assessment of trivial risks or for 
evaluation of standard controls will lead to collection 
^)f more information that can possibly be used, and to 
situations where important facts are lost in a mass of 
spurious documentation. 

C- 2 OVERVIEW 

C-2.1 Basic Steps 

The following steps are followed in identification of 
liazard and assessment and control of risk: 

a) Identify hazards; 

b^ Estimate the risk (the likelihood and severity 
of harm) from each hazardous event; and 

c I Decide if the risk is tolerable (for this purpose 
a tolerable risk criteria should be evolved 
which should take into consideration the legal 
requirements and other norms in that activity). 



C-2.2 Necessity 

Employers are legally obliged to carry out OH&S risk 
assessments. Their main purpose is to determme 
whether planned or existing controls are adequate. The 
intention is that risks should be controlled before harm 
could occur. 

For many years OH&S risk assessments have been 
carried out usually on an informal basis. It is now 
recognized that risk assessment are a key foundation 
for proactive OH&S management and that systematic 
procedures are necessary to ensure their success. 

A risk assessment based on a participative approach 
provides an opportunity for management and the w/ork- 
force to agree that an organization's OH&S procedures: 

a) are based on shared perceptions of hazards 
and risks, 

b) are necessary and workable, and 

c) will succeed in preventing accidents. 

C-2.3 Pitfalls and Solutions 

Poorly planned assessments, carried out in the brief 
that they are bureaucratic impositions, will waste time 
and change nothing. Moreover, organizations may get 
bogged down in detail, where completion of assessment 
proforma becomes an end in itself. Risk assessnient 
should provide an inventory for action and form the 
basis for implementing control measures. Potential risk 
assessors may have become complacent. People who 
are too close to situations may no longer perceive and 
recognize hazards, or perhaps judge risks as trivial 
because to their knowledge no one has been harmed. 
The aim should be that everyone tackles risk 
assessments with a fresh pair of eyes and a questioning 
approach. Risk assessment should be carried out by 
competent people with practical knowledge of the work 
activities, preferably with colleagues from another part 
of the organization, who may have greater objectivity. 
A worthwhile approach, whenever possible, is to train 
small teams to carry out assessments. 

Ideally, everyone should contribute to assessments that 
relate to them. For example, they should tell assessors 
what they think about the need for and feasibility of 
particular risk controls. In larger organizations a 
competent person, usually from within the 
organization, should coordinate and guide the 
assessors' work. Specialist advice may need to be 
sought. 
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NOTH — Pitfall of simple risk coticcpt is thai it can not 
disringuish high probability low consequence events frem tow 
probability high consequence events, 

C-3 PRINCIPLE 

C-3,1 Figure 3 shows ihe principle of risk assessment. 
The steps are outlined below and described fully 
m C-4, C-5 and C-6. 



Classify work activities 



i 



Identify hazards 



i 



Determine risk 



Decide if risk is tolerable 



Prepare risk control action 
plan 



Review adequacy of action 
plan 



Fig. 3 The Prochss of Risk Assessment 

C-3.2 The following criteria are necessary for 
organizations to carry out effective risk assessment: 

a) Classify work activities — prepare a list of 
work activities covering plant, raw materials/ 
chemicals handled, premises, people and 
procedures, and gather information about 
them; 

b) Identify hazards — identify ;iil ha/.ards 
relatnig to each work activity. Consider who 
might be harmed and how; wtiat uught he 
damaged and how; 

c ) Dele rm iue risk — m a k e a s u bj ec [ i ve e st i m ale 
of risk associated with each hazard assuminj: 
that planned or existing controls are in place. 
Assessors should also consider the 
effectiveness of the controls and the 
consequences of their failure; 

d) Decide if risk is tolerable — Judge whether 
planned or existing OH&S precautions (if 
any) arc sufficient to keep the hazard under 
control and meet legal requirements; 

e) Prepare risk control action plan {if 



necessary) — prepare a plan to deal with any 
issues found by the assessment to require 
attention. Organizations should ensure that 
new and existing controls remain in place and 
are effective; and 

f) Review adequacy of action plan — reassess 
risks on the basis of the revised controls and 
check that risks will be tolerable. 

NOTE — The word 'tolerable' here means thai risk has been 
reduced to the lowest level that is reasonably practicable. 

C-3.3 Risk Assessment Requirements 

If risk assessment is to be useful in practice 
organizations should: 

a) appoint a senior member of the organization 
to promote and manage the activity; 

b) consult with everyone concerned; discuss 
what is planned to be done and obtain their 
comments and commitment; 

c) determine risk assessment training needs for 
assessment personnel/teams and implement 
a suitable training programme; 

d) review adequacy of assessment; determine 
whether the assessiTient is suitable and 
sufficient; that is to say, adequately detailed 
and rigorous; and 

e) document administrative details and 
significant findings of the assessment. 

It is generally not necessary to make precise numerical 
calculation of risk. Complex methods for quantified 
risk assessment are normally required only where the 
consequences of failure could be catastrophic. Risk 
assessment in major hazard industries is related to the 
approach required in other workplaces, but in most 
organizations much simpler subjective methods arc 
appropriate. 

The assessment of risks to health associated with 
exposure to toxic substance and harmful emissions may 
require, for example, tneastircmcnts of airborne dust 
concentrations or noise exposure. 

C-4 PROCEDURE 

C-4,1 General 

The sub-clause describes the factor that an organization 
should consider when planning the risk assesstiient. 
Attention is drawn to the need to reter to relevant 
regulations and guidance to ensure that specific legal 
requirements are met. The risk assessment process 
described here covers all OH&S hazards, it is better to 
integrate assessment for all hazards, and not carry out 
separate assessment for health hazards, manual 
handling machinery hazards and so on. if assessment 
is carried out separately, using different methods. 
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ranking risk control priorities is more difficult, separate 
assessment may also lead to needless duplication. 

The following aspects of risk assessment need to be 
considered carefully at the outset: 

a) Design of a simple risk assessment proforma 
(see C-4.2); 

b) Criteria for classifying work activities and 
information needed about each work activity 
{see C-4,3 and C-44); 

c) Method of identification and categorization 
hazards (see C-S.l); 

d) Procedures for making an informed 
determination of risk (see C-5.1); 

e) Words to describe estimated risk levels 
(see Tables 1 and 2); 

Criteria for deciding whether risks are 
tolerable: whether planned or existing control 
measures are adequate (see C-6.1); 

g) Preferred methods for risk control (see C-6.2); 

h) Time scales for implementing remedial action 
(where necessary) (see Table 2); and 

j) Criteria for reviewing adequacy of action plan 
(see C-6.3), 

C-4.2 Risk Assessment Proforma 

Organizations should prepare a simple proforma that 
can be used to record the findings of an assessment, 
typically covering: 

a) Work activity; 

b) Hazard(s); 

c) Controls in place; 

d) Personnel at risk; 

e) Likelihood of harm; 
Severity of harm; 
g) Risk level; 

h) Action to be taken following the assessment; 

and 
j) Administrative details, for example, name of 

assessor, date, etc. 

Organizations should develop their overall risk 
assessment procedure and may need to carry out trials 
and continually review the system, 

C-4.3 Classification of Work Activities 



Classify work activities 



A necessary preliminary to risk assessment is to prepare 
a list of work activities, to group them in a rational and 
manageable way, and to gather necessary information 
about them- It is vital to include, for example, 



infrequent maintenance tasks, as well as day-to-day 
production work. Possible ways of classifying work 
activities include: 

a) Geographical areas within/outside the 
organization's premises; 

b) Stages in the production process, or in the 
provision of a service; 

c) Planned and reactive work; and 

d) Defined tasks (for example driving). 

C-4.4 Work Activity Information Requirements 

Information required for each work activity should but 
are not limited to include items from the following: 

a) Tasks being carried out, their duration and 
frequency; 

b) Location(s) where the work is carried out; 

c) Who normally/occasionally carries out the 
tasks; 

d) Who else may be affected by the work (for 
example visitors, sub-contractors, the public); 

e) Training, that personnel have received about 
the tasks; 

f) Written systems of work and/or permit-to- 
work procedures prepared for the tasks; 

g) Plant and machinery that may be used; 
h) Powered hand tools that may be used; 

j) Manufacturers' or suppliers' instructions for 

operation and maintenance of plant machinery 

and powered hand tools; 
k) Size, shape, surface character and weight of 

materials that might be handled; 
m) Distance and heights of the place where 

materials have to be moved by hand; 
n) Services used (for example compressed air); 
p) Substances used or encountered during the 

work; 
q) Physical form of substances used or 

encountered (fume, gas, vapour, liquid, dust/ 

powder, solid); 
r) Content and recommendations of safety data 

sheets relating to substances used or 

encountered; 
s) Relevant acts, regulations and standards 

relating to the work being done, the plant and 

machinery used, and the materials used or 

encountered; 
t) Control measures believed to be in place; 
u) Available monitoring data gained as a result 

of information from within and outside the 

organization, incident, accident and ill-health 

experience associated with the work being 

done, equipment and substances used; and 



24 



IS 18001 : 2007 



v) Finding of any existing assessments relating 
to the work activity. 

C-5 ANALYZING RISK 
C-5.1 Identification of Hazards 
C-5. 1.1 General 

Classify work activities 



i 



Identify hazards 



Three questions enable hazard identification: 

a) Is there a source of harni? 

b) Who (or what) could be harmed? and 

c) How could harm occur? 

Hazards that clearly possess negligible potential for 
harm should not be documented or given further 
consideration. 

C-5. 1.2 Broad Caie^ories of Hazard 

To help with the process of identifying hazards it is 
useful to categorize hazards in different ways, for 
example: 

a) Mechanical, 

b) Electrical, 

c) Radiation, 

d) Substances, 

e) Fire and explosion, 
Toxic release, and 
g) Natural calamities. 

C'5.1.3 Hazard Prompi-List 

A complementary approach is to develop a prompt- 
list of questions such as: 

Louring work activities could the following hazards 
exist? 

a) Slips/falls on the level; 

b) Falls of persons from heights; 

c) Falls of tools, materials, etc, from heights; 

d) Inadequate headroom: 

e) Hazards associated wiih manual lifting/ 
handling of tools, material, etc; 

f) Hazards from plant and machinery associated 
with assembly, commissioning, operation, 
maintenance, modification, repair and 
dismantling; 

g) Vehicle hazards, covering both site transport, 
and travel by road; 



h) Fire and explosion; 

j) Violence to staff; 

k) Substances that may be inhaled; 

m) Substances or agents that may damage the 

eye; 
n) Substances that may cause harm by coming 

into contact with, or being absorbed through, 

the skin; 
p) Substances that may cause harm by being 

ingested (for example entering the body via 

the mouth); 
q) Harmful energies (for example, electricity, 

radiation, noise, vibration); 
r) Work-related upper limb disorders resulting 

from frequently repeated tasks; 
s) Inadequate thermal environment, for example 

too hot; 
t) Lighting levels; 
u) Slippery, uneven ground/surfaces; 
v) Inadequate guard rails or hand rails on stairs; 

and 
w) Sub-contractors' activities. 

The above list is not exhaustive. Organizations should 
develop their own hazard *prompt-list' taking into 
;iccount the nature of their work activities and locations 
where work is carried out. 

C-5.2 Determination of Risk 
C-5.2.1 General 

Classify work activities 



Identify hazards 



1 



Determine risk 



The risk from the hazard should be determined by 
estimating (he potential severity to harm and the 
likelihood that harms will occur. 

C-5, 2.2 Severity of Harm 

Information obtained about work activities (see C-4.4) 
is a vital input to risk assessment. When seeking to 
establish potential severity of harm, the following 
should also be considered: 

a) Part(s) of the body likely to be affected; 

b) Nature of the harm, ranging from slightly to 
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extremely harmful: 

1 ) Slightly harmful, for example: 

i) superficial injuries; minor cuts and 

bruises; eye irritation from dusi; 
ii) nuisance and irritation (for example 
headaches); ill-health leading to 
Temporary discomfort; 

2) Harmful, for example: 

i) lacerations; burns; 
ii) contusion; serious sprains; 
iii) minor fractures; 
iv) deafness; dermatitis; asthma; 
v) work related upper limb disorders; 

and 
vi) disorders; ill-health leading lo 
permanent minor disability; and 

3) Extremely harmful, for exan^ple: 

i) amputations; major fractures; 
ii) poisonings; multiple injuries, 
iii) fatal injuries; 
iv) occupational cancer; other severely 

life shortening diseases; and 
v) acute fatal diseases- 
OS. 2, 3 Likelihood of Harm 

When seeking to establish likelihood of harm the 
adequacy of control measures already implemented and 
complied with needs to be considered. Here legal 
requirements and codes of practice are good guides 
covering controls of specific hazards. The following 
issues should then typically be considered in addition 
to the work activity information given in C-4.4: 

a) Number of personnel exposed; 

b) Frequency and duration of exposure to the 
hazard; 

c) Failure of services, for example, electricity 
and water; 

d) Failure of plant and machinery components 
and safety devices; 

e) Exposure to the elements; 

f) Protection afforded by persona! protective 
equipment and usage rale of personal 
protective equipment; and 

g) Unsafe acts (unintended errors or intentional 
violations of procedures) by persons, for 
example, who: 

1 ) may not know what the hazards are; 

2) may not have the knowledge, physical 
capacity, or skills to do the work; 



3) underestimate risks to which they are 
exposed; and 

4) underestimate the practicality and utility 
of safe working methods. 

It is important to take into account the consequences of 
unplanned events. These subjective risk estimations 
should normally take into account all the people exposed 
to a hazard. Thus any given hazard is more serious if it 
affects a greater number of people. But some of the larger 
risks may be associated with an occasional task carried 
out Just by one person, for example, maintenance of 
inaccessible parts of lifting equipment. 

C-6 EVALUATION OF RISK 
C-6,1 Risk Tolerance 

Classify work activities 



i 



Identify hazards 

i 

Determine risk 

i 



Decide if risk is tolerable 



Table 1 shows one simple method for estimating risk 
levels and for deciding whether risks are tolerable. 
Risks are classified according to their estimated 
likelihood and potential severity of harm. Some 
organizations may wish to develop more sophisticated 
approaches, but this method is a reasonable starting 
point. Numbers may be used to describe risks, instead 
of the terms 'moderate risk\ 'substantial risk\ etc. 
However using numbers does not conter any greater 
accuracy to these estimates. 

Table 1 Simple Risk Level Estimator 

(Clauses CA A r/m/C-6.l) 
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Probability 


Slightly 


Harmful 


Kxtremciv 


of 


Harmful 




H armful 


Occurrence 








(1) 


(2) 


(3) 


(4) 


High Unlikely 


Trivial risk 


Tolcr-'blc 


Moderate 






risk 


risk 


Uniikciv 


Tolerable 


Moderate 


Substantial 




risk 


risk 


risk 


Likely 


Moderate 


Substantial 


Intolerable 




risk 


risk 


risk 


NOTE — Tolerable here means 


that risk has beer 


reduced to 


the lowest level that is reasonably practicable. 
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C-6.2 Risk Control Action Plan 

Classify work activities 

Identify ha7.ard$ 

I 

Determine risk 
Decide if risk is tolerable 

i 

I Prepare risk control action plan I 

An approach, again suggested as a starting point, is 
shc^wn in Table 2. U shows that control measures and 
urgency should be proportional to risk. The ourxome 
of a risk assessment should be an inventory o\' actions, 
in priority order, to devise, maintain or improve 
controls. A procedure for planning the implementation 

of necessary changes following risk assessment is 
described in C-6.4. 

Controls should be chosen taking into account the 
following: 

a) If possible, eliminate hazards altogether, or 
combat risks at source, lor example, use a safe 
substance instead of a dangerous one or 
reduce inventory level of hazardous 
substance; 

If elimination is not possible, try to reduce 
the risk, lor example, by using a low voltage 
electrical appliance; 

Where possible adapt work to the individual 
for example, to take account of individual 
mental and physical capabilities; 

d) Take advantage of technical progress to 
improve controls; 
Measures that protect everyone; 
A blend of technical and procedural controls 
is usually necessary; 

The need to introduce planned maintenance 
of, for example, machinery safeguards; 
Adopt personal protective equipment only as 
a last resort, after all other control options 
have been considered; 
The need for emergency arrangement; and 
Proactive measurement indicators are 
necessary to monitor compliance with the 
controls. 



b) 



c) 



e) 

g> 
h) 



J) 
k) 



development of emergency and evacuation plans and 
provision of emergency equipment relevant to the 
organization's hazards. 

Table 2 Simple Risk-Based Control Plan 

(Clauses C-4J and C-6.2) 

Risk Level Action and Time Scale 

(I) (2) 

Trivial No action is required and no dcx:umentary 

record needs to be kept 

ioierable No additional controls are required. 

Consideration may be given to a more 
cost-elTective solution or improvement 
that imposes no additional cost burden. 
Monitoring is required to ensure that the 
controls arc maintained 

Moderate FJTorts should be made to reduce the risk, 

but the cost of prcvenlion should be 
carefully measured and limited. Risk 
reduction measures should be 
implemented 

Substantial Work should not be started until the risk 

has been reduced. Considerable resources 
may have to be allocated to reduce the 
risk where the risk involves work in 
progress, urgent action should be taken 

Intolerable Work should not be started or continued 

until the risk has been reduced. If it is not 
possible to reduce risk even with 
unlimited resources, work has to remain 
prohibited 

C-6.3 Adequacy of Action Plan 

Classify work activities 

Identify hazards 

i 

Determine risk 

1 

Decide if risk is tolerable 



Prepare risk control action plan 



Review adequacy of action plan 



Consideration also needs to be given to the 



The action plan should be reviewed before 
implementation, typically by asking: 
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a) Will ihe revised controls lead to tolerable risk 
levels? 

b) Arc new hazards created? 

c) Has the most cost-effective solution been 
chosen? 

d ) W h a t do peo p 1 e a ITe e te d th i n k a bo u 1 1 he n eecl 
for, and feasibility of, the revised preventive 
measures? 

e) Will the revised controls be used in practice, 



and not ignored in the face of, for example, 
pressures to get the job done? 

C-6.4 Changing Conditions and Revising 

Risk assessment should be seen as a continual process. 
Thus, the adequacy of control measures should be 
subject to continual review and revised if necessary. 
Similarly, if conditions change to the extent that 
hazards and risks are significantly affected then risk 
assessments should also be reviewed. 
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